Findings

What a 5-domain assessment actually turns up.

These are representative patterns, not client case studies. The point is to show how a control gap becomes a documented finding, a decision, and a fix.

The Process

How evidence becomes a working control.

From current-state observation to an implemented control that can be operated and maintained.

Assess

Observe how the workflow and control operate today.

Diagnose

Collect evidence and score control strength, exposure, effort, and urgency.

Decide

Choose the remediation path: process, configuration, integration, or software.

Implement

Configure, test, train, and roll out the validated fix.

Run

Operate, monitor, and confirm the control continues to hold as conditions change.

The point is not the score. It is a working control: clearer ownership, less avoidable waste or manual effort where measurable, and better system capability where justified.

Representative Patterns

Five domains. Before and after remediation.

Examples of how a documented control gap can change after the right fix.

Travel & Expense

BeforePolicy exists, but enforcement happens after the trip is booked and the money is committed.

AfterPolicy is enforced at booking; exceptions are routed before purchase and visible to finance.

AP & Invoice Approval

BeforeInvoice entry, approval, and payment can collapse onto one person; vendor bank changes lack consistent verification evidence.

AfterRoles are separated and bank-detail changes are verified and evidenced before payment release.

Contract Management

BeforeContracts live across inboxes and shared drives; ownership and renewal windows are unclear.

AfterEvery contract has one system of record, a named owner, and renewal alerts early enough to act.

SaaS & Licensing

BeforeFinance lacks a validated inventory; duplicate tools and unused seats surface only at renewal.

AfterOne inventory tracks owner, renewal, usage, and cost so waste is visible before the next invoice.

Card Program Administration

BeforeCards and limits depend on manual memory; offboarding may not close access immediately.

AfterControls are set at issuance and termination events close access through a defined offboarding workflow.

Assessment Evidence

What a scored assessment ledger looks like

Each discovery point is scored individually. Domain scores summarize the pattern, while material critical failures are surfaced separately so they cannot disappear into an average.

§ Assessment Ledger · 5 Domains · 40 Subdomains · Up to 156 Points of Control

Assessed / no material deficiency Finding / watch Absent / not in place

T&E

CONTRACTS

SAAS

CARDS

A Finding, In Full

From symptom to verified fix

Illustrative Finding

FindingT&E policy is documented but not enforced at booking.

EvidenceOut-of-policy exceptions are identified only after purchase.

Business EffectFinance reviews exceptions after spend is committed; preventable policy breaches cannot be stopped upstream.

Remediation PathConfigure pre-booking policy enforcement and exception routing.

Software DecisionUse the existing platform if it can enforce the requirement; replace only if the requirement cannot be met.

VerificationSample bookings after rollout and confirm exceptions route before purchase.